- syslog-ng - lists.balabit.hu

syslog-ng 3.2.4 : How to handle syslogs with multiple lines
by Jay 30 Sep '11

30 Sep '11

Hello I am using syslog-ng on RHEL 5 Some syslogs from devices are wrapped. i.e. some syslogs contain multiple lines. In such cases, syslog-ng is treating each line as a separate syslog. I need all lines beloging to that syslog to be considered as single line. The \n\r (s) should be ignored. Adding flags (no-multi-line) option didn't help. Could someone help to address this issue, please ? Thanks

1 0

[Bug 136] New: duplicated logpaths gives no error
by bugzilla＠bugzilla.balabit.com 29 Sep '11

29 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=136 Summary: duplicated logpaths gives no error Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balazs.nemeth(a)balabit.com Type of the Report: --- Estimated Hours: 0.0 During my daily work I started to experience to receive every log message twice. It turned out that I made a silly copy&paste mistake but syslog-ng showed no warning or something like that at all. Steps to reproduce: 1) create a config like this # snippet start parser pattern_db { db_parser( file("/var/lib/misc/patterndb.xml") ); }; source s_netcat { tcp(ip(127.0.0.1) port(5514)); }; destination d_patterndb { file("/var/log/hosts/$HOST/$R_YEAR.$R_MONTH.$R_DAY/messages-${.classifier.class}"); }; log{ source(s_netcat); parser(pattern_db); destination(d_netcat); }; log{ source(s_netcat); parser(pattern_db); destination(d_netcat); }; # snippet end 2) send logs with netcat 3) check that every log message arrives twice to the given destination syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: Aug 16 2011 09:13:16 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

current 3.3 git
by Peter Czanik 29 Sep '11

29 Sep '11

Hello, There were many updates to 3.3 git this afternoon. I did a quick compile, packaging and functional test on my platforms (FreeBSD and openSUSE). I did not do many tests, but what I tried seems to work fine. >From the previous git version I found only one change: README was removed, so package lists had to be changed. You can find my current openSUSE syslog-ng package together with syslog-ng sources at https://build.opensuse.org/package/show?package=syslog-ng&project=home%3Acz… The file name says beta2, but it's actually a git snapshot from this afternoon. Have a nice weekend! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 3

"Errors" in /var/log/messages
by Aldrich, Jamie S 28 Sep '11

28 Sep '11

I have setup syslog-ng to report application logs to a LogLogic device over UDP. Below is a excerpt of the syslog.conf file: source s_file_fs3 { file("/tmp/APPSRV_fs3_current.LOG" flags(no-parse) follow-freq(1)); }; destination d_messages{ udp("10.13.33.11" port(514)); }; log { source(s_file_fs3); destination(d_messages); }; I am seeing the following messages from our OSSEC server and /var/log/messages: OSSEC HIDS Notification. 2011 Sep 28 09:50:11 Received From: lxfwossecp3->/var/log/messages Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)." Portion of the log(s): Sep 28 09:50:10 lxfwossecp3 syslog-ng[3992]: Log statistics; processed='destination(d_mail)=2', processed='destination(d_spol)=0', processed='source(s_file_fs3)=1690', processed='global(payload_reallocs)=218', processed='source(s_sys)=325', processed='destination(d_mesg)=114', processed='global(msg_clones)=0', processed='src.internal(s_sys#2)=114', stamp='src.internal(s_sys#2)=1317220810', processed='destination(d_kern)=0', processed='destination(d_mlal)=0', processed='destination(d_cron)=200', dropped='dst.udp(d_messages#0,10.13.33.11:514)=0', processed='dst.udp(d_messages#0,10.13.33.11:514)=20670', stored='dst.udp(d_messages#0,10.13.33.11:514)=0', processed='global(sdata_updates)=0', processed='destination(d_auth)=9', processed='destination(d_boot)=0', processed='source(s_file_hr1)=2025', processed='center(received)=0', processed='source(s_file_fs1)=3896', processed='destination(d_messages)=20670', processed='source(s_file_hr2)=2743', processed='center(queued)=0', processed='source(s_file_fs2)=2662', processed='source(s_file_hr3)=7654' Do we have an issue? It looks like the log size is too large to process correctly, and it is kicking it out. What would we need to do to remedy the situation? Jamie

2 1

[Bug 135] New: pipe() source missing follow_freq() option
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=135 Summary: pipe() source missing follow_freq() option Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 According to the 3.2 documentation, the pipe() source is supposed to support the follow_freq() option. However attempting to use it results in an error: Error parsing affile, syntax error, unexpected KW_FOLLOW_FREQ, expecting ')' Looking at the current source tree in git, the option is not allowed in the configuration syntax. http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=blob;f=modules/affile/af… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 4

syslog-ng in books
by Peter Czanik 28 Sep '11

28 Sep '11

Hello, I just updated the list of book mentioning syslog-ng. For a list of recently found books check my blog at https://czanik.blogs.balabit.com/2011/09/syslog-ng-in-books/ If you learn about any other books not listed by us, and writing about syslog-ng in detail, please let us know, so we can update our list. Also, if you write an interesting blog, article, etc. about syslog-ng, please don't hesitate publishing at least a link about it here in the mailing list. For example there was a great blog series posted by Monitis at http://blog.monitis.com/index.php/tag/syslog-ng/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Memory Growth in syslog-ng
by Pramod Pillai 28 Sep '11

28 Sep '11

Hi I am using syslog-ng 3.1.2 . I am observing that memory is growing approximately 64 MB, every 6 or 7 hours. The growth is consistent. Is this a known issue . Any patch available to fix it. sh-3.00# ./syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on

3 3

Reading from standard input
by Remy Zandwijk 28 Sep '11

28 Sep '11

Hi list, I use syslog-ng to create log files from within a script. The script sends the message through a pipe to syslog-ng, which I use as command line tool. In the syslog-ng.conf I created a source which reads the standard input. very simplified: Config: source src { pipe("/dev/fd/0"); }; destination dst { file("/tmp/test.log"); }; log { source(src); destination(dst); }; Called as: echo "test" | /usr/sbin/syslog-ng -f /tmp/syslog-ng.conf This works perfectly in 2.0.9. Now I am in the process of upgrading the system and syslog-ng 3.2.4. With this version of syslog-ng the config file above results in an error: Error opening file for reading; filename='/dev/fd/0', error='Text file busy (26)' Error initializing source driver; source='src', id='src#0' Error initializing message pipeline; I tried several things to get rid of this error, like replacing 'pipe' in 'file', but nothing seems to work. Any ideas? Regards, Remy

2 3

Re: [syslog-ng] log file size limit
by Sergei Zhirikov 28 Sep '11

28 Sep '11

On 2011-07-25 17:50, William Tambellini wrote: > Dear Syslog-ng team, > > We are currently evaluating syslog-ng in order to satisfy some requests from our customers regarding logs from our software. > One of their requests is to limit log file size using some kind of rotation algo : if size > 6Mo then rotate to another file. > We have found some options in file destination like fifo buffer control but nothing about files rotation. > Is there anything for that kind of feature ? > I have a patch that does something of that kind. When the log file grows above certain size syslog-ng switches to a new one and renames the old one. Further processing (such as compression) should be done externally. I posted that patch in this list quite some time ago, but as far as I can tell, it went unnoticed... -- Sergei.

4 7

Re: [syslog-ng] How to send tracebacks through syslog-ng? (Jakub Jankowski)
by Luis Pugoy 28 Sep '11

28 Sep '11

> > Message: 4 > Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST) > From: Jakub Jankowski <shasta(a)toxcorp.com> > Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <alpine.LNX.2.00.1109240928240.15891(a)bluzg.slackware.pl> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On 2011-09-24, Luis Pugoy wrote: > > > rewrite r_rewrite_subst { subst("a*", "?", value("MESSAGE") type("pcre") > > flags("utf8" "global")); }; > > > > I thought that it would replace 0 or more occurrences of 'a' with a > question > > mark. However, when the input is 'a', the output becomes 'a?'. It just > > appends a question mark at the end. 'aa' also becomes 'aa?'. What is > weirder > > still is that even if the input does not contain 'a', the question mark > is > > still appended. So '1' becomes '1?'. > > Well, does "1" match /a*/ ? :) > It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind of > regexp matches everything, even an empty string. > > HTH > > -- > Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ > GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D Hello Jakub. Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't the resulting replacement be "?" instead of "1?" ? Also, if I just use /a/ and use "a" as input, it does not seem to match. The text is still outputted as "a". >

2 2